Security Auditor (Expert)

Pueo Business Solutions LLC•McLean, VA

2d•$147,742 - $167,888•Onsite

About The Position

Pueo is seeking an experienced Security Auditor to work onsite in McLean, Virginia. The role supports the Defense Intelligence Agency (DIA) Chief Information Office, JWICS Program Division (CIO6), in managing and executing the JWICS Connection Approval Program. The Security Auditor conducts technical and non-technical Approval to Connect (ATC) assessments of DIA JWICS customers’ requests to connect nodes to JWICS, applying knowledge of Department of Defense and Intelligence Community cybersecurity policies and regulations, Security Technical Implementation Guides (STIGs), and the NIST Risk Management Framework (RMF). The position produces and coordinates formal reports, briefs, circuit connection packages, technical documentation, and cyber-profile assessments that communicate connection risks to the JWICS enterprise. It works with CIO entities, subscribers, ATC stakeholders, and other organizations to assess compliance in the context of subscriber architectures and Authorizing Official risk decisions. The role also evaluates ATC data and supports recommendations to improve the maturity of continuous monitoring (CONMON), ATC, and POA&M management processes, with the goal of minimizing risk to JWICS. The Security Auditor participates in planning, executing, and reporting ATC assessments; collaborates with subscribers to integrate vulnerability assessments; and helps prepare ATC foundational documents, Security Risk Assessments, and other compliance deliverables. The role communicates system risks and vulnerabilities through presentations, verbal briefings, and written materials.

Requirements

Current and active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph.
Bachelor’s degree in a related field and 12 years of experience, or 16 or more years of experience in lieu of a completed degree.
One IAT III certification compliant with DoD 8570.01-M and DoD Directive 8140, such as CASP+ CE, CCNP Security, CISA, CISSP or CISSP Associate, GCED, GCIH, or CCSP.
Experience with Intelligence Community security policies, including understanding of DoD and IC cybersecurity policies and regulations, STIGs, and NIST RMF.
Familiarity with a variety of cybersecurity concepts, practices, and procedures.
Ability to draft, coordinate, and finalize standard operating procedures, business processes, and workflow designs, and manage their execution for ATC, CONMON, and POA&M management activities.
Experience with scanning and GRC tools.
Hands-on RMF and A&A experience relevant to Security Auditor work.

Nice To Haves

Active Top Secret clearance with SCI eligibility and a current CI polygraph.
DIA ATC experience.
Experience with SSP, SAR, POA&M, and ATO ownership; fluency with the NIST 800-series.
Experience with scanning and GRC tools such as XACTA/eMASS and ACAS, STIGs, and vulnerability triage and remediation versus risk acceptance.
Strong independent work ethic and auditor mentality, exceptional oral and written communication skills, and ability to work unsupervised.
Solid interpersonal and communication skills for effective interaction with stakeholders and team members.

Responsibilities

Conduct technical and non-technical Approval to Connect assessments of DIA JWICS customers’ requests to connect nodes to JWICS.
Apply DoD and IC cybersecurity policies and regulations, STIGs, and NIST RMF knowledge during ATC activities.
Prepare documentation, formal reports, briefs, and circuit connection packages to support Approval to Connect while minimizing risk to JWICS.
Interact with CIO entities, subscribers, and other stakeholders to assess whether subscriber connections meet foundational compliance requirements, considering subscriber architecture and AO risk decisions.
Evaluate ATC data to identify strategic efficiencies or tactical cyber-signatures and recommend improvements to CONMON, ATC, and POA&M management processes.
Draft, coordinate, and collaborate on technical documentation and cyber-profile assessments that communicate connection risks to the JWICS enterprise.
Collaborate with ATC stakeholders to ensure connection cybersecurity risks are clearly communicated and understood.
Participate in planning, execution, and reporting of ATC assessments, and collaborate with subscribers to integrate vulnerability assessments.
Assist with preparing and organizing ATC foundational documents, Security Risk Assessments, and other compliance data.
Communicate the impact of system risks and vulnerabilities verbally, through presentations, and in written deliverables.
Draft, coordinate, and finalize standard operating procedures, business processes, and workflow designs, and manage their execution for ATC, CONMON, and POA&M activities.